Following the decision of the ECJ on 6 October 2015 declaring the EU-US Safe Harbor system for data transfer invalid, the Article 29 Working Group of European data protection authorities has now issued a statement setting out its views on several critical issues going forward.

The statement emphasizes that transfers relying on Safe Harbor are now unlawful.  The WP29 considers that, on an interim basis, the EU Standard Contractual Clauses (or Model Clauses) and Binding Corporate Rules (BCRs) can still be relied upon to legitimize transfers of EU personal data to the United States, pending negotiations over the future of the Safe Harbor arrangements.

During that time, the WP29 will “continue its analysis of the impact of the CJEU judgment on other transfer tools” (including the Model Clauses and BCRs).

National data protection authorities will in the meantime exercise their powers in response to complaints if necessary to protect individuals’ privacy rights.

The statement indicates that if no appropriate solution is found between the EU and the US authorities by the end of January 2016, EU data protection authorities are committed to taking all necessary and appropriate actions, which may include coordinated enforcement actions.

Click here for a copy of the statement.